Detect potential file enumeration activity ASIM Web Session

// HTTP response status codes indicate whether a specific HTTP request has been successfully completed.
// Please refer this for more details: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
let HTTPErrorCode=dynamic(["404"]);
let threshold = 10; // You can update this threshold to the value that suites your environment
// let FileNotFoundRequests = 
_Im_WebSession (starttime=ago(1h))
| where EventResultDetails in~ (HTTPErrorCode)
// Filter the logs to include only HTTP GET requests with an HTTP status code of 404 and '/' in the URL
| where HttpRequestMethod =~ "GET" and Url contains "/"
| summarize
    RequestCount = count(),
    FileCount=dcount(Url),
    EventStartTime=min(TimeGenerated),
    EventEndTime=max(TimeGenerated),
    RequestURLs = make_set(Url, 100),
    DestinationIPList=make_set(DstIpAddr, 100)
    by SrcIpAddr, SrcUsername, SrcHostname, DstHostname
| where RequestCount > threshold  // Adjust the threshold as per your requirements
| extend Name = iif(SrcUsername contains "@", tostring(split(SrcUsername,'@',0)[0]),SrcUsername), UPNSuffix = iif(SrcUsername contains "@",tostring(split(SrcUsername,'@',1)[0]),"")

description: |
    'This detection method identifies potential cases of file enumeration activity. The query is designed to identify client sources that generate multiple requests resulting in 404 error codes'
status: Available
entityMappings:
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Name
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: DstHostname
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: SrcHostname
    identifier: HostName
  entityType: Host
relevantTechniques:
- T1083
- T1071
- T1110
id: b3731ce1-1f04-47c4-95c2-9827408c4375
triggerOperator: gt
query: |
  // HTTP response status codes indicate whether a specific HTTP request has been successfully completed.
  // Please refer this for more details: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
  let HTTPErrorCode=dynamic(["404"]);
  let threshold = 10; // You can update this threshold to the value that suites your environment
  // let FileNotFoundRequests = 
  _Im_WebSession (starttime=ago(1h))
  | where EventResultDetails in~ (HTTPErrorCode)
  // Filter the logs to include only HTTP GET requests with an HTTP status code of 404 and '/' in the URL
  | where HttpRequestMethod =~ "GET" and Url contains "/"
  | summarize
      RequestCount = count(),
      FileCount=dcount(Url),
      EventStartTime=min(TimeGenerated),
      EventEndTime=max(TimeGenerated),
      RequestURLs = make_set(Url, 100),
      DestinationIPList=make_set(DstIpAddr, 100)
      by SrcIpAddr, SrcUsername, SrcHostname, DstHostname
  | where RequestCount > threshold  // Adjust the threshold as per your requirements
  | extend Name = iif(SrcUsername contains "@", tostring(split(SrcUsername,'@',0)[0]),SrcUsername), UPNSuffix = iif(SrcUsername contains "@",tostring(split(SrcUsername,'@',1)[0]),"")  
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Web Session Essentials/Analytic Rules/PotentionalFileEnumeration.yaml
tactics:
- Discovery
- CommandAndControl
- CredentialAccess
queryPeriod: 1h
name: Detect potential file enumeration activity (ASIM Web Session)
severity: Medium
customDetails:
  EventStartTime: EventStartTime
  RequestCount: RequestCount
  EventEndTime: EventEndTime
  DestinationIPList: DestinationIPList
  RequestURLs: RequestURLs
  FileCount: FileCount
requiredDataConnectors: []
triggerThreshold: 0
version: 1.0.0
queryFrequency: 1h
kind: Scheduled
tags:
- Schema: WebSession
  SchemaVersion: 0.2.6
alertDetailsOverride:
  alertDisplayNameFormat: User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed with performing file enumeration activity
  alertDescriptionFormat: User generated multiple requests '{{RequestCount}}' that has resulted in error code '404', suggesting the possibility of file enumeration activity. It's important to investigate the source and patterns of these extensive 404 errors to identify potential security threats. Details about this error code could be found [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status)